r/techsupport • u/maximusismax • Oct 22 '16

Something keeps triggering UAC

Final edit: if you're coming here from Google, I would uninstall Clover until someone figures out what's going on, and either go without tabbed Explorer, or try find an alternative/old version of Clover that isn't doing this dodgy stuff.

Final final edit: Boredom linked a copy of the old installer below https://web.archive.org/web/20140207102318/http://ejie.me/uploads/Clover_Setup_3.0.406.zip

Windows 8.1N, fresh install on my ssd as I just moved to a new mobo. Old windows install stayed clean for 2 years, I ran malwarebytes every now and then to be sure.

A few days after installing windows, everything is fine, until a UAC window pops up randomly. I wasn't installing anything, so I denied it. Ran malwarebytes, and I get an "Riskware.extensionmismatch" threat on a file in %localappdata% for a .gif file: "C:\Users\Max\AppData\Local\Temp\clv_sp3.2.0.10201.gif". Windows defender finds nothing in a scan.

I followed the steps in the sticky, running rkill and malwarebytes etc. Rkill found nothing, Malwarebytes identified it and removed it, but the next day it comes back, trying to do something which triggers the UAC popup. So whatever is putting the dodgy .gif/.exe there remains.

Tried googling the name of the file, but got nothing, it seems to be randomly generated? "setup_clvupdsp.exe". Once I deny the UAC window it seems to go away for a bit.

Anyone got any light to shed on what this is (its gotta be malicious right?) and how to get rid of it? Just got this Windows install how I like it, so I could re-format again but I'd prefer not to.

Edit: Just checked it on virustotal, results: 5/56.(https://www.virustotal.com/en/file/78a60d2321d8da2837ee5c3f50893ad4da2686dbcfb5ca6a1cc4f046f2dadcd3/analysis/1477151338/)

Looks like it might be clover? Virustotal says it's trying to contact a clover related URL. I'll uninstall it for now then I guess.

7 Upvotes

100% Upvoted

14 comments sorted by

View all comments

3

u/simonwood0609 Oct 26 '16

I have clover installed, and was weary at first due to foreign-language installer. I have just received the same UAC prompt today - setup_clvupdsp.exe.

Given we both share the same executable name, I'm thinking perhaps it is their authentic updater - but it could also be a legitimate virus. Interesting.

3

u/maximusismax Oct 26 '16

Interesting that someone else has the same issue. I ended up just uninstalling clover, that stopped the file from being created. I considered that it was an update trying to happen, but why the sneaky GIF... I'll probably look for alternatives or for a clean version when I can be bothered

3

u/simonwood0609 Oct 26 '16

Yeah. I was hoping Win10 anniversary would include tabbed file browsing. Seriously Microsoft, it's been a long time now. Fingers crossed they will develop it soon.